18 hours is a very long time to react to a security bug like this as any data would have be "hacked" in minutes.

Probably M1 Social Media do not work on weekends so this was given a missed.

One of the issues here is that when a security bug is found by a user, the user had to go through the long process of submitting the screenshot at M1 Feedback Site. In cases like this, a direct message would have been better to expedite the issue.

Singapore will soon exempt local operators, Singapore Pools and Turf Club, from online gambling ban and the sites will be ready in November 2016.

Ministry of Home Affairs explained that a complete ban on remote gambling drives demand and activities
underground, and may create larger incentives for criminal syndicates to
target Singapore."

Yet in a 2012 survey by the National Council on Problem Gambling (NCG) found that those who gamble online have the poorest control.

Source: https://app.msf.gov.sg/Portals/0/Summary/research/EDGD/Gambling%20participation%20survey%202011.pdf
For those who indulged in online gambling, 30.4% said they gambled for a longer period than they planned to, 33.3% gambled with more money than they planned and 29.2% gambled more frequently they planned to.
Will launching the online gambling sites be like opening a Pandora Box that will create more issues in the future?